LXC - Revision history

MkWikiEnSysOp: /* Common problems */ +AppArmor problems when running Ubuntu 24.04 on Debian 11/12 host

2026-05-01T20:58:14Z

Common problems: +AppArmor problems when running Ubuntu 24.04 on Debian 11/12 host

← Older revision		Revision as of 20:58, 1 May 2026
Line 72:		Line 72:

	== Common problems ==		== Common problems ==

			=== AppArmor problems when running Ubuntu 24.04 on Debian 11/12 host ===

			Add this section to <code>/etc/apparmor.d/abstractions/lxc/container-base</code>:

			# 2026/05/01: Ubuntu 24.04 Systemd Sandboxing Compatibility
			# This block allows modern systemd to create nested mount namespaces and use pivot_root.

			# --- 1. Propagation & Transition Rules ---
			mount options=(rw, rslave) -> /,
			mount options=(rw, rshared) -> /,
			mount options=(rw, rprivate) -> /,
			mount options=(rw, slave) -> /run/systemd/incoming/,
			mount options=(rw, rslave) -> /dev/,

			# --- 2. Namespace Creation (Proc/Shm) ---
			mount fstype=proc proc -> /run/systemd/namespace-*/,
			mount fstype=ramfs srcname=ramfs -> /dev/shm/,
			mount fstype=ramfs options=(rw, nosuid, nodev, noexec) -> /dev/shm/,

			# --- 3. The mount-rootfs Sandbox (The Core Fix) ---
			# Allows systemd to populate the sandbox from the real root
			mount options=(rw, rbind) / -> /run/systemd/mount-rootfs/,

			# Allows masking sensitive files/dirs (ProtectHome, ProtectSystem, etc.)
			mount options=(rw, rbind) /run/systemd/inaccessible/ -> /run/systemd/mount-rootfs/,

			# Allows mapping system, proc, run, and tmp into the sandbox
			mount options=(rw, rbind) /{proc,sys,run,tmp,var}/ -> /run/systemd/mount-rootfs/{proc,sys,run,tmp,var}/,
			mount options=(rw, rbind) /run/systemd/unit-root/ -> /run/systemd/mount-rootfs/,

			# Allows the 'remount' phase where systemd sets nosuid/nodev/noexec on sandboxed paths
			mount options=(rw, nosuid, nodev, noexec, remount, bind) -> /run/systemd/mount-rootfs/**,

			# Allows systemd to self-bind inside the sandbox for propagation changes
			mount options=(rw, rbind) /run/systemd/mount-rootfs/ -> /run/systemd/mount-rootfs/,

			# --- 4. Final Handoff ---
			pivot_root /run/systemd/mount-rootfs/ -> /run/systemd/mount-rootfs/**,
			pivot_root /run/systemd/mount-rootfs/ -> /run/**,

			Credits: [https://gemini.google.com/share/5ee155a48492 Chat with Gemini]

	=== Debian Container in Ubuntu until 14.10 or Debian 10 (buster) ===		=== Debian Container in Ubuntu until 14.10 or Debian 10 (buster) ===

MkWikiEnSysOp: /* Simple installation of Debian with some useful packages */ Added package ca-certificates to example

2023-09-30T21:36:55Z

Simple installation of Debian with some useful packages: Added package ca-certificates to example

← Older revision		Revision as of 21:36, 30 September 2023
Line 22:		Line 22:
	=== Simple installation of Debian with some useful packages ===		=== Simple installation of Debian with some useful packages ===

	lxc-create -n deb12c1 -t debian -- -r bookworm --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx		lxc-create -n deb12c1 -t debian -- -r bookworm --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx,ca-certificates

	==== Troubleshooting key ring errors with debootstrap ====		==== Troubleshooting key ring errors with debootstrap ====

MkWikiEnSysOp: /* Simple installation of Debian with some useful packages */

2023-09-30T21:10:38Z

Simple installation of Debian with some useful packages

← Older revision		Revision as of 21:10, 30 September 2023
Line 22:		Line 22:
	=== Simple installation of Debian with some useful packages ===		=== Simple installation of Debian with some useful packages ===

	lxc-create -n ~~deb10c1~~ -t debian -- -r bookworm --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx		lxc-create -n deb12c1 -t debian -- -r bookworm --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx

	==== Troubleshooting key ring errors with debootstrap ====		==== Troubleshooting key ring errors with debootstrap ====

MkWikiEnSysOp: /* Simple installation of Debian with some useful packages */ Changed suite to bookworm

2023-09-30T21:10:23Z

Simple installation of Debian with some useful packages: Changed suite to bookworm

← Older revision		Revision as of 21:10, 30 September 2023
Line 22:		Line 22:
	=== Simple installation of Debian with some useful packages ===		=== Simple installation of Debian with some useful packages ===

	lxc-create -n deb10c1 -t debian -- -r ~~buster~~ --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx		lxc-create -n deb10c1 -t debian -- -r bookworm --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx

	==== Troubleshooting key ring errors with debootstrap ====		==== Troubleshooting key ring errors with debootstrap ====

MkWikiEnSysOp: Added Troubleshooting key ring errors with debootstrap

2021-11-24T20:48:49Z

Added Troubleshooting key ring errors with debootstrap

← Older revision		Revision as of 20:48, 24 November 2021
Line 23:		Line 23:

	lxc-create -n deb10c1 -t debian -- -r buster --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx		lxc-create -n deb10c1 -t debian -- -r buster --packages nano,screen,iputils-ping,less,dnsutils,bind9-host,wget,nginx

			==== Troubleshooting key ring errors with debootstrap ====

			Container creation might fail with these messages (Debian Bullseye on Ubuntu 18.04):

			<pre>
			debootstrap ist /usr/sbin/debootstrap
			Checking cache download in /var/cache/lxc/debian/rootfs-bullseye-amd64 ...
			Downloading debian minimal ...
			I: Retrieving InRelease
			I: Checking Release signature
			E: Release signed by unknown key (key id 605C66F00D6C9793)
			Failed to download the rootfs, aborting.
			Failed to download 'debian base'
			failed to install debian
			lxc-create: deb11webdev: lxccontainer.c: create_run_template: 1617 Failed to create container from template
			lxc-create: deb11webdev: tools/lxc_create.c: main: 327 Failed to create container deb11webdev
			</pre>

			The reason is that <code>debootstrap</code> is using the key rings installed in /usr/share/keyrings/. On older Ubuntu systems the key rings for newer Debian releases, like Bullseye, are missing. They can be easily installed using the package from a newer Ubuntu version since there are no dependencies (as can be seen on Ubuntu's package information page [https://packages.ubuntu.com/impish/debian-archive-keyring debian-archive-keyring (2021.1.1ubuntu1)]).

			wget http://de.archive.ubuntu.com/ubuntu/pool/universe/d/debian-archive-keyring/debian-archive-keyring_2021.1.1ubuntu1_all.deb
			dpkg -i debian-archive-keyring_2021.1.1ubuntu1_all.deb

			After that, /usr/share/keyrings/debian-archive-bullseye* exist:

			-rw-r--r-- 1 root root 8.5K 2021-03-26 12:11 /usr/share/keyrings/debian-archive-bullseye-automatic.gpg
			-rw-r--r-- 1 root root 8.6K 2021-03-26 12:11 /usr/share/keyrings/debian-archive-bullseye-security-automatic.gpg
			-rw-r--r-- 1 root root 2.4K 2021-03-26 12:11 /usr/share/keyrings/debian-archive-bullseye-stable.gpg

	== Configuration ==		== Configuration ==

MkWikiEnSysOp: GitHub --> GitLab

2021-05-30T12:51:09Z

GitHub --> GitLab

← Older revision		Revision as of 12:51, 30 May 2021
Line 205:		Line 205:
	== Links ==		== Links ==

	* [https://~~github~~.com/MichaelKremser/lxcscripts Repository "lxcscripts" from Michael Kremser at ~~GitHub~~: contains various useful scripts]		* [https://gitlab.com/MichaelKremser/lxcscripts Repository "lxcscripts" from Michael Kremser at GitLab: contains various useful scripts]
	* [https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html Container configuration man page]		* [https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html Container configuration man page]
	* [https://wiki.ubuntuusers.de/LXC/ LXC in ubuntuusers.de (German)]		* [https://wiki.ubuntuusers.de/LXC/ LXC in ubuntuusers.de (German)]

MkWikiEnSysOp: Inserted solution for Apache2 not running inside container

2021-05-27T19:46:40Z

Inserted solution for Apache2 not running inside container

@@ Line 127: / Line 127: @@
   service bind9 start
-=== Apache2 not running inside container (UNSOLVED) ===
+=== Apache2 not running inside container ===
 With my host Ubuntu 18.04 (version of LXC is 3.0.3-0ubuntu1~18.04.1 as of 2019/09/14), Apache won't run inside Debian containers created by these commands:
@@ Line 134: / Line 136: @@
   lxc-create -n deb10c2 -t download -- -d debian -r buster
-It fails with this message:
+Obviously [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=918839 this bug] is related.
 == Tips and tricks ==

MkWikiEnSysOp: /* Debian Container in Ubuntu until 14.10 or Debian 10 (buster) */

2021-05-27T19:42:32Z

Debian Container in Ubuntu until 14.10 or Debian 10 (buster)

← Older revision		Revision as of 19:42, 27 May 2021
Line 45:		Line 45:

	=== Debian Container in Ubuntu until 14.10 or Debian 10 (buster) ===		=== Debian Container in Ubuntu until 14.10 or Debian 10 (buster) ===

			==== Symptoms ====

	Directly after creation of the container it cannot be started. The following error message is being displayed:		Directly after creation of the container it cannot be started. The following error message is being displayed:
Line 54:		Line 56:
	[3283539.709422] audit: type=1400 audit(1621956401.478:8529): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=14968 comm="(vnstatd)" srcname="/" flags="rw, rbind"		[3283539.709422] audit: type=1400 audit(1621956401.478:8529): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=14968 comm="(vnstatd)" srcname="/" flags="rw, rbind"

	~~Solution: Inserting a line in the config-file of the container (usually located in /var/lib/lxc/CONTAINER/config)~~:		Or services like Apache2 won't start:

	~~lxc~~.~~aa_profile~~ = ~~unconfined~~		apache2.service: Failed to set up mount namespacing: Permission denied
			apache2.service: Failed at step NAMESPACE spawning /usr/sbin/apachectl: Permission denied
			apache2.service: Control process exited, code=exited, status=226/NAMESPACE

			==== Solution ====

	~~In LXC 3+ it is~~		Inserting a line in the config-file of the container (usually located in /var/lib/lxc/CONTAINER/config):

	lxc.apparmor.profile = unconfined		lxc.apparmor.profile = unconfined

			In LXC version 2 it was

			lxc.aa_profile = unconfined

	[http://www.panticz.de/LXC-create-Debian-Jessie-container Credits]		[http://www.panticz.de/LXC-create-Debian-Jessie-container Credits]

MkWikiEnSysOp: Updated for LXC 3+

2021-05-25T16:57:37Z

Updated for LXC 3+

← Older revision		Revision as of 16:57, 25 May 2021
Line 44:		Line 44:
	== Common problems ==		== Common problems ==

	=== Debian Container in Ubuntu until 14.10 ===		=== Debian Container in Ubuntu until 14.10 or Debian 10 (buster) ===

	Directly after creation of the container it cannot be started. The following error message is being displayed:		Directly after creation of the container it cannot be started. The following error message is being displayed:

	Failed to mount cgroup at /sys/fs/cgroup/systemd: Permission denied		Failed to mount cgroup at /sys/fs/cgroup/systemd: Permission denied

			Or you get a lot of lines in dmesg similar to that one:

			[3283539.709422] audit: type=1400 audit(1621956401.478:8529): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=14968 comm="(vnstatd)" srcname="/" flags="rw, rbind"

	Solution: Inserting a line in the config-file of the container (usually located in /var/lib/lxc/CONTAINER/config):		Solution: Inserting a line in the config-file of the container (usually located in /var/lib/lxc/CONTAINER/config):

	lxc.aa_profile = unconfined		lxc.aa_profile = unconfined

			In LXC 3+ it is

			lxc.apparmor.profile = unconfined

	[http://www.panticz.de/LXC-create-Debian-Jessie-container Credits]		[http://www.panticz.de/LXC-create-Debian-Jessie-container Credits]

MkWikiEnSysOp: /* Apache2 not running inside container (UNSOLVED) */

2020-01-13T17:41:41Z

Apache2 not running inside container (UNSOLVED)

← Older revision		Revision as of 17:41, 13 January 2020
Line 111:		Line 111:
	=== Apache2 not running inside container (UNSOLVED) ===		=== Apache2 not running inside container (UNSOLVED) ===

	With my host Ubuntu 18.04 (version of LXC is 3.0.3-0ubuntu1~18.04.1 as of 2019/09/14), Apache won't run Debian containers created by these commands:		With my host Ubuntu 18.04 (version of LXC is 3.0.3-0ubuntu1~18.04.1 as of 2019/09/14), Apache won't run inside Debian containers created by these commands:

	lxc-create -n deb10c1 -t debian -- -r buster		lxc-create -n deb10c1 -t debian -- -r buster